Unrated
CVE-2026-55808
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
Unrated
CVE-2026-55807
Drupal core - SA-CORE-2026-008
Unrated
CVE-2026-55806
Drupal core - SA-CORE-2026-007
Unrated
CVE-2026-55804
Drupal core - SA-CORE-2026-006
Unrated
CVE-2026-55803
Drupal core - SA-CORE-2026-005
Medium
CVE-2026-55590
CakePHP Authentication: Open redirect weakness via backslash bypass
Medium
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
High
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
Medium
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Medium
CVE-2026-48784
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Medium
CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Medium
CVE-2026-48747
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Medium
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
High
CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Medium
CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
Medium
CVE-2026-12198
Microweber vulnerable to Path Traversal
Medium
CVE-2026-49740
TYPO3 CMS has Insecure Deserialization via Core API
Low
CVE-2026-49738
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
Medium
ghsa-6jq6-x4cx-qvcm
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
Medium
CVE-2026-48067
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Critical
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
Medium
CVE-2026-53723
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
Medium
CVE-2026-48998
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Medium
CVE-2026-49214
guzzlehttp/psr7 has CRLF Injection via URI Host Component
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.